SilentCanvas - Hidden Desktop Initialization (T1564)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•5

Identifies the execution of WindowsBackstageShell.exe used to create the invisible alternative desktop environment, as observed in Operation SilentCanvas.